[Expense tests] Re-enable Expense Agent API tests

[Prangshuman Das (t-prda)]

Review focus: the Expense test changes and the auth-helper deletion; the enableCleanTestCodeunitExecution line. The large JSON diffs are temporary disables, undone in C.

Re-enables the Expense Agent API tests on top of the default web service key auth. No Key Vault password and no auth subscriber.

• Deletes Expense API Test Auth Helper and its usages.
• Re-applies the Expense fixes from [Expense tests] Re-enable reviewed APIs and consolidate Expense fixes #12325 (reverted in Revert Expense API test re-enablement and consolidated fixes #12514): TravelRequestApproval, Expense permission and spend-request tests, the ExpDetailTest permission set, and SpendRequestTests.
• Turns on enableCleanTestCodeunitExecution, as [Expense tests] Re-enable reviewed APIs and consolidate Expense fixes #12325 did, so RequiredTestIsolation = Disabled codeunits run in clean-tenant lanes.
• Expense disabled tests: keeps only the entries NAV master also disables (12).
• Temporarily disables the unrelated APIV1/APIV2 tests that the clean lanes start executing, the same entries [Expense tests] Re-enable reviewed APIs and consolidate Expense fixes #12325 added. They are re-enabled in the next layers.

Related: AB#646383, AB#653393

Stack (each PR shows only its own layer; merge bottom first)

1. [API tests] Default to web service key authentication #12674 A: web service key auth (base: main)
2. [Expense tests] Re-enable Expense Agent API tests #12675 B: Expense API tests + clean test codeunit execution
3. [API tests] Re-enable APIV1 and APIV2 API tests #12676 C: re-enable APIV1/APIV2 API tests
4. Area fixes: [API tests] Ensure VAT posting setup in API document fixtures #12677 D1 VAT fixtures → [API tests] Ensure cancellation reason codes in API sales document tests #12678 D2 cancellation reasons → [API tests] Handle localized purchase invoice payment discounts in APIV1 tests #12679 D3 localized discounts → [API tests] Set sales quote document and posting dates in API tests #12680 D4 quote dates → [API tests] Assign a number series to API vendor payment journals #12681 D5 journal numbering → [API tests] Ignore localized fields in API document comparisons #12682 D6 field comparison → [API tests] Return shipment PDF selection and pdfDocument test isolation #12683 D7 PDF documents → [API tests] Improve APIV1 fixture and verification reliability #12684 D8 APIV1 reliability

Experiments (on D8, do not merge): #12685 E single tenant, #12686 F no clean execution. Combined validation (do not merge): #12687, same tree as D8.

Platform: main already pins BCPlatform 30.0.56112.0, which includes the SQL connection-pool fix (AB#653457).

Note for CI: AL-Go's new-warning check needs a CI/CD baseline from the base branch, and features/* bases have none, so a PR build there fails with a 404. The current CI runs were triggered while these PRs targeted main, so their results are valid for the cumulative change.

[github-actions]

$\textbf{🟠\ High\ Severity\ —\ Testing}$

The newly enabled negative API test uses asserterror without checking the resulting error message or code, so an unrelated failure can make the test pass without proving that the unlinked Expense User is hidden. Add an assertion for the expected 404 response error.

Knowledge:

• microsoft/knowledge/testing/asserterror-needs-expectederror-and-code.md

Line mapping was unavailable, so this was posted as an issue comment.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.50.6}

[alexei-dobriansky]

Good Sense Reviewer - Round 1

Recommendation: Accept with Suggestions

What this PR does

This change re-enables Expense API coverage under the default web service key authentication, removes the test-only authentication subscriber, and enables clean execution for disabled-isolation test codeunits. It also restores targeted Expense fixes, including exact approver filtering, permission checks, and spend-request total coverage.

The authentication removal is consistent with the base provider. The approver-filter change avoids compressed ranges and quotes filter operators correctly, with focused coverage for wildcard, pipe, and range-gap user numbers. The temporary API exclusions are removed by the following stack layers.

Problem-solution fit

Fit: Strong

The change directly restores the blocked API suites after the shared authentication and runtime prerequisites became available. The code and tests match the reported clean-tenant and approval-filter scenarios.

Suggestions

S1 (🟠 Moderate): Negative API test accepts unrelated failures
Before re-enabling UnlinkedExpenseUserIsHiddenFromAPI, assert the expected 404 error after asserterror. As written, any request or authentication failure can satisfy the test, so this scenario can pass without proving the user is hidden.

Risk assessment and necessity

Risk: Risk is concentrated in the repository-wide clean-codeunit setting and the new exact-value approver filter. The full CI matrix passes, the broad APIV1/APIV2 exclusions are explicitly temporary in the following stack, and the production filter change is covered for wildcard, pipe, and range-gap user numbers. No public API or event signature changes are introduced.

Necessity: The change is needed to restore Expense API coverage and remove a credential-injection helper that is no longer required by the shared authentication provider. The scope is appropriate for the stacked rollout, but the re-enabled negative test should assert the exact 404 failure.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=12675 round=1 by=alexei-dobriansky at=2026-10-13T13:12:06Z lastSha=6dd7533571c924c72cb6255f58b4144356c842ca reviewKey=49b637bd0ccf060f1a04591d8b8701697b61f3d60f0ca06633171201629ae2b8 suggestions=S1@77d8d452

[Prangshuman Das (t-prda)]

Valid point. This is pre-existing Expense Agent test code that this PR only re-enables, so it is tracked separately: AB#654047, fixed in follow-up #12773 (asserts Response code is 404 after the asserterror, so a 401/500 or unrelated error no longer passes the negative test).

[alexei-dobriansky]

Good Sense Reviewer - Reply

Thanks for the details. Responses to your point:

• S1 - Agree. The follow-up adds the exact 404 assertion, so unrelated authentication or server errors will no longer satisfy this test. I withdraw this point for this PR.

---

[AI-PR-REPLY] version=1 promptVersion=4 system=github pr=12675 reviewRound=1 by=alexei-dobriansky at=2026-10-13T19:11:44Z respondsTo=2026-10-13T15:26:38Z reviewKey=49b637bd0ccf060f1a04591d8b8701697b61f3d60f0ca06633171201629ae2b8

[github-actions]

$\textbf{🟡\ Medium\ Severity\ —\ Testing}$

The API test suite is being re-enabled while its manual authentication subscriber is deleted, but the new setting only changes test-codeunit execution cleanup and does not authenticate the outbound OData requests. Keep an authentication mechanism or provide an explicitly authenticated test endpoint before enabling these HTTP tests; otherwise the request can fail before the asserted API behavior runs.

Line mapping was unavailable, so this was posted as an issue comment.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.50.6}

[github-actions]

$\textbf{🟡\ Medium\ Severity\ —\ Web\ Services}$

The change deletes the only test-only Basic authentication subscriber and removes its BindSubscription calls while enabling the HTTP API scenarios. The LibraryGraphMgt requests therefore have no explicit authentication path on the OnPrem test target and can receive 401 responses instead of exercising the API. Restore an authenticated test handler or configure a dedicated authenticated test company before enabling these tests.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.50.6}

[github-actions]

$\textbf{🟠\ High\ Severity\ —\ Testing}$

The change enables UnlinkedExpenseUserIsHiddenFromAPI, but its negative request still uses bare asserterror without checking the expected 404 error. Any unrelated request failure, including authentication or setup failure, can therefore make the newly enabled test pass; assert the expected response error (and code where available) after the call.

Knowledge:

• microsoft/knowledge/testing/asserterror-needs-expectederror-and-code.md

Line mapping was unavailable, so this was posted as an issue comment.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.50.6}